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Background 

NASA is currently investigating a Crew Emergency Return Vehicle 
(CERV) to provide assured crew return for Space Station Freedom. 
While the Space Station, in conjunction with the Space Shuttle, 
is capable of handling many emergency situations on its own, NASA 
has found at least three situations where a CERV is essential: 

O Medical Emergency - Provide the crew with the ability 
to evacuate seriously injured/ill crewmember from the 
Space Station to a ground based care facility under 
medically tolerable conditions. 

O Station Catastrophe - Provide the crew with the ability 
for a safe and time-critical evacuation of the Space 
Station in the event the Space Station becomes 
uninhabitable . 

0 Shuttle Problems - Provide the crew with the ability to 
return safely to Earth from the Space Station in the 
event NSTS flights are interrupted for a time that 
exceeds Space Station ability for crew support and/or 
safe operations. 

The NASA Phase A investigations over the past several years 
identified the above requirements and they have been documented 
as Design Reference Missions 1, 2, and 3 respectively (DRM's 1, 

2, 3) within the CERV Systems Performance Requirements Document 
(SPRD) , JSC 31017. 

The CERV SPRD has been prepared as functional and performance 
requirements in such a manner as to minimize design specificity 
of the requirements. The CERV Project intent is to identify the 
minimum set of requirements that will enable the project 
objective of a simple, reliable, cost effective vehicle and give 
the contractor maximum design freedom. The CERV Phase A'/B 
procurement effort, currently scheduled to begin October 2, 1989, 
is intended to affirm the existing project requirements or to 
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amend and modify them based on thorough evaluation of the 
contractor (s) recommendations. 

The CERV design must be capable of simple, nearly automatic 
operation because its control will probably be by a physically 
deconditioned crew. Therefore, although crew intervention may be 
required, it is not envisioned that CERV operation will require 
highly trained piloting skills to operate the CERV for 
separation, deorbit, entry, and landing activities. 

The CERV must be available for immediate use throughout the life 
of the Space Station. Therefore, reliability is an important 
design requirement for the CERV. If the CERV is to be a highly 
reliable vehicle, the onboard systems must to be simple, and use 
proven state-of-the-art technology, with robust design margins 
and sufficient systems redundancy to be available for immediate 
use. 

Long periods of dormancy are a desirable design objective. 

Dormant systems exhibit higher reliability than those that are 
active. However, establishing confidence in the CERV System may 
require periodic systems health check tests and evaluations. 

These periodic system health checks would be made utilizing the 
CERV avionics hardware/software systems in conjunction with the 
Space Station and must be capable of diagnostic isolation of a 
failed system to the ORU level. This implies, among other things 
the of sharing some limited resources with the Space Station, 
e.g. power, ECLSS, communications, personnel, etc.. 

To enhance CERV System reliability while minimizing life cycle 
costs, it will be a Program goal to embed CERV operations within 
existing, ongoing programs such as NSTS and Space Station 
Freedom. Launch and delivery of the CERV to Space Station 
Freedom will be accomplished using existing NSTS and ELV 
capabilities. Once at the Space Station, CERV activation, 
periodic checkout, and maintenance will become an integrated part 
of the Space Station workday activity, although with minimal 
interference to ongoing productive activities. On the ground, 
existing facilities and personnel at KSC will largely suffice for 
prelaunch processing, logistics, and turnaround operations. The 
highly flexible workstations and reconfiguration environment 
currently under development at JSC for the NSTS and Space Station 
Control Centers will enable those facilities to accommodate CERV 
mission planning and real-time support. And finally, a vital 
link in the operations concept will be provided by reliance upon 
existing worldwide Search and Rescue capabilities, both U.S. and 
international . 

The JSC CERV Project Office, during its in-house Phase A studies, 
evaluated the following four CERV concepts (shown in figure 1) : 
a) The Reference Configuration, b) The Benchmark Configuration - 
SCRAM, c) The Apollo Derivative, and d) The LaRC Lifting Body 
Configuration . 
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Candidate CERV Vehicle Approaches 
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FIGURE 1. CERV PHASE A STUDY CONFIGURATIONS 


The following treatment of the CERV avionics systems is presented 
with the caveat that a firm CERV system design has not been 
selected at this time. The following discussion in not to be 
construed as expressing a preferential avionics system/subsystem 
configuration by the JSC CERV Project Office. 

For the purposes of this symposium the reference configuration 
concept avionics systems will be presented. 

CERV Avionic Systems 

The avionics systems design is required to perform the three 
DRM's with minimal crew participation. It is assumed that the 
crew will have limited training in CERV operations, as well as 
being in a physically deconditioned state. The crew may 
participate in some simple operational functions? however, those 
functions that require skilled piloting capabilities will be 
automated . 

Another avionics systems design goal is availability. 

Availability dictates a fail-safe avionics system/ subsystem that 
will be backed up by redundancy in critical systems, by other 
systems/subsystems automatically, or by limited crew 
participation . 

Space Station emergencies, DRM2, place the most severe 
requirements on the avionics system/ subsystem. The CERV must be 
in a safe configuration and ready for departure within minutes 
after a Space Station emergency is declared and it is determined 
that crew evacuation is required. This condition will allow 
minimal planning, warmup, and checkout time. 

The avionics hardware design objectives will be to comply with 
the Space Station interfaces and possess some degree of ORU 
commonality. The ORU commonality is desireable from the CERV 
standpoint to the extent that simplicity and reliability is not 
compromised. 

The JSC CERV Project Office Phase A reference configuration 
concept evaluations identified the following systems: 

Guidance, Navigation, and Control 

Displays and Control 

Communication and Tracking 

Electrical Power 

Propulsion 

Pyrotechnic 

Environmental Control and Life Support 

Thermal Protection 

Medical 

Landing and Recovery 
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Of these systems the first four are considered to make up the 
avionics systems. The remainder are integrally related to the 
avionics in the demand-command response sense. 

The system contains dual avionics strings for redundancy. Two 
General Purpose Computers (GPC's) with their associated software 
and Multiplexer/De-Multiplexers (MDM's) comprise the heart of the 
system, essentially the Data Management System (DMS) . The GPC's 
will run simultaneously but not synchronously. The primary GPC 
will be in control of system operation until a fault is detected; 
then it will be automatically switched to the secondary GPC. 
Individual ORU's will be selected or deselected automatically by 
the GPC's. Fault detection logic to select other 

systeras/subsystems will also be contained in the GPC's to operate 
similarly to the above fault selection subsystem. Manual 
override will be possible through keyboard entries. Dual MDM's 
will be used to interface the other GN&C subsystems and Reaction 
Control System (RCS) jet drivers to the GPC's. The dual Inertial 
Measurement Units (IMU's) , dual Horizon Sensors and Global 
Positioning System (GPS) will also be interfaced to the GPC's 
through the MDM's. Sensor data, including medical, will be 
linked through the MDM to the GPC for onboard decision-making or 
for downlink to the ground by the S-band. 

A single-string GPS system could be used to obtain the state 
vector for CERV, especially in the DRM-2 application. Where time 
permits prior to Space Station separation, the CERV state vector 
initialization will be obtained by an exchange of information 
with the Space Station. The backup for acquiring a state vector 
will be the single-string S-band with telemetry and command 
uplink capability. A state vector can also be entered manually 
via the keyboard. 

Guidance. Navigation, and Control (GN&C) 

The GN&C system block diagram is shown in figure 2. The system 
possesses the following characteristics: 

0 Two strings with cross-strapping between units 
0 Strings consist of: 

- General Purpose Computers 
Multiplexers/ De-Multiplexers 
Inertial Measurement Units 
Horizon Scanner 
Reaction Jet Drivers (RJD's) 

0 Horizon sensors and gyrocompassing are used for attitude 
alignment 

0 Sensors provide systems information to the GPC's for 
systems control and/or for use with communications or 
telemetry 

0 The GPC's provide control to most of the CERV 
systems/ subsystems 
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CONTROL TO SUBSYSTEMS 
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FIGURE 2. GN&C SYSTEM 












CERV Software 


The CERV software will be developed independently of the Space 
Station software? however, in keeping with aforementioned 
embedded operations, its development may use the existing Space 
Station Program rules and tools, e.g. Software Support 
Environment (SSE) . Space Station software interface criteria 
will be satisfied such that periodic health test checkout and 
evaluations can be performed. The software subsystem will 
control the sequence of the startup and shutdown of CERV 
systems/ subsystems and will provide GN&C for Space Station 
separation, landing site targeting, deorbit maneuvers, reentry 
control, and landing. 

Since this software is designed for an emergency vehicle, there 
should be no constraint on its use in unexpected situations. The 
software will also support the fault detection and isolation 
functions. For durability, reliability, and quick activation, 
the software may be put into the read only memory (ROM) of the 
GPC ' s . Provisions for updating the CERV software will be 
included. For example, the CERV is currently thought to 
interface to the Space Station resource nodes one and three, top 
ports. Should the Space Station configuration change such as to 
impact the CERV location and departure trajectory, then the CERV 
GN&C will have to change. 

Displays and Controls 

The Displays and Controls (D&C) subsystem is designed to minimize 
the crew interface but to allow some manual override if 
necessary. Manual override will not be required but will support 
system reconfiguration if such is required. Manual control will 
be allowed for noncritical systems based on cost, training 
factors, and subsystem complexity. In keeping with the 
philosophy of minimizing crew interface and training, no hand 
controls are provided for vehicle maneuvering. 

The primary interface between the crew and CERV subsystems may be 
electroluminescent (EL) screens and keyboards. These units will 
be used to monitor subsystems, display information, and provide 
inputs to the GPC's. Reconfiguration of the avionics and 
communications subsystems can be accomplished manually if so 
desired. The crew will also have access to switches and circuit 
breakers for manual override in limited circumstances. A caution 
and warning display and master alarm will be provided to enhance 
safety. A fire detection and suppression system will also be 
provided. 

Manual control will be provided for a portion of the ECLSS 
related to crew comfort and for lighting. The UHF communications 
subsystem will be manually controlled by the crew. The Search 
and Rescue Satellite (SARSAT) system will be controlled by the 
GPC's. 
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Caution & Warning 



FIGURE 3. DISPLAYS AND CONTROLS SYSTEMS 



















The D&C system is completely redundant and is derived from the 
Space Station work station. It contains an embedded processor to 
relieve the GPC of the task of formatting and displaying data. 

The similarity to the Space Station work station will minimize 
CERV training. Figure 3 is an example of such a display and 
control subsystem. 

Communications and Tracking 

The communications subsystem will be a single— string subsystem 
with the redundancy provided by other backup subsystems. The 
communication subsystem will be automatically controlled by the 
CERV GPC with manual override by the crew being provided through 
the D&C keyboard. The UHF subsystem, except for the SARSAT 
beacon, will be manually controlled by the crew and will be the 
backup voice communications subsystem. The SARSAT beacon is 
controlled by the GPC. A voice intercom subsystem will be 
provided to the Space Station audio subsystem. Data 
communication with the Space Station will be provided through a 
direct interconnect between the CERV MDM's and the Space Station 
data busses. 

The Global Positioning System (GPS) receiver, which will have 
redundant antenna selected by either the GPC or manually by the 
crew, will provide direct inputs to the GPC for the state vector. 
The GPS will be the primary source of state vector with backup 
being provided by the Space Station or the ground through the 
S-band subsystem. 

The single— string S— band subsystem will have three antennas 
selected by either the GPC or manually and will be the primary 
voice, telemetry, and command uplink subsystem. The voice 
subsystem will have the UHF subsystem for backup but the 
telemetry and command subsystem will have no backup. A failure 
of this subsystem would not endanger the CERV mission. 

Power 


The power subsystem as conceived for the reference configuration 
is a lithium-bromine complex (LI-BCX) battery pack. The size and 
weight of the CERV batteries have been determined based on the 
requirements of the minimum weight and volume, minimum on orbit 
maintenance, minimum turn-on time at time of use, and redundancy. 
Although a 4-year shelf life is desired, shelf life data for this 
subsystem is only available for two years. It is anticipated 
that shelf life data to support the 4+ years shelf life will be 
available by the mid-1990's. Storage temperature of zero degrees 
Fahrenheit would enhance storage life. 

Power safety plugs complete the circuit between power busses and 
controllers when installed after the CERV is berthed to the Space 
Station. This ensures no battery drain prior to connection to 
the main power controllers. 
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The Electrical Power Distribution Subsystem (EPDS) is conceived 
to be designed for single fault tolerance and to be capable of 
providing the energy needed for the CERV mission. Two separate 
power controllers will distribute power even if a battery 
subsystem or controller fails. The individual power controllers 
can be switched to the other battery bus for additional 
redundancy. 

The CERV GPC will provide automatic control and fault detection 
for the EPDS. Essential power from each battery bus will provide 
power to the GPC's and MDM's. Power to these subsystems can also 
be provided through the main buses. Figure 4 depicts the 
Electrical Power System. 

Another battery concept of interest is the Lithium Reserve 
Battery. In this application the battery electrolyte is 
stored in a separate reservoir until the CERV is required to be 
activated for a mission. Upon activation the electrolyte is 
injected into the battery cells. This approach provides 
long-term on orbit storage without voltage degradation and 
minimizes battery thermal requirements. This concept, however, 
would require Space Station power for periodic test and checkout 
of the CERV. 

Summary 

The Crew Emergency Return Vehicle (CERV) is being defined to 
provide Assured Crew Return Capability (ACRC) for Space Station 
Freedom. The CERV, in providing the standby "lifeboat" 
capability, would remain in a dormant mode over long periods of 
time as would a lifeboat on a ship at sea. The vehicle must be 
simple, reliable, and constantly available to assure the crew's 
safety. The CERV must also provide this capability in a 
cost-effective and affordable manner. 

The CERV Project philosophy of a simple vehicle is to maximize 
its useability by a physically deconditioned crew. The vehicle 
reliability goes unquestioned since, when needed, it is the 
vehicle of last resort. Therefore, its systems and subsystems 
must be simple, proven, state-of-the-art technology with 
sufficient redundancy to make it available for use as required 
for the life of the program. 

The CERV Project Phase A'/ B Request For Proposals (RFP) is 
currently scheduled for release on October 2, 1989. The Phase 
A'/ b effort will affirm the existing project requirements or 
amend and modify them based on a thorough evaluation of the 
contractor (s) recommendations. The system definition phase, 

Phase B, will serve to define CERV systems and subsystems. The 
current CERV Project schedule has Phase B scheduled to begin 
October 1990. Since a firm CERV avionics design is not in place 
at this time, the above treatment of the CERV avionics complement 
for the reference configuration is not intended to express a 
preference with regard to a system or subsystem. 
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FIGURE 4. ELECTRICAL POWER SYSTEM 













